JWT Decoder
Paste a JSON Web Token to decode its header and payload into readable, pretty-printed JSON — instantly.
Private by design: decoding happens entirely in your browser — your token is never uploaded or stored anywhere. Note that this tool decodes the token; it does not verify the signature.
—
—
—
How it works
A JSON Web Token is three base64url-encoded segments joined by dots: header.payload.signature. The header is a small JSON object naming the signing algorithm (such as HS256) and the token type. The payload carries the claims — statements about the user or session like a subject id, an expiry time (exp), or an issued-at time (iat). The signature is created by the issuer with a secret key so a server can later confirm the token was not tampered with. Crucially, the header and payload are only encoded, not encrypted: anyone holding the token can read them, which is why you should never put secrets in a JWT. Decoding here simply reverses the base64url encoding; trusting the token still requires verifying the signature with the issuer's key, which must happen on a server — never in a browser tool.